Sekoia has linked a mobile watering-hole campaign that copied a London luxury hotel next to the Ministry of Defence to Russia’s APT29. It used no zero-days, only already-patched flaws in iPhones and Android phones, which makes it a test of how well UK organisations keep their mobile estates up to date.
What happened
On 4 November 2026, French security firm Sekoia published research into a campaign it has named “Poisoned Source”. Its researchers found the activity in mid-October. Sekoia attributes it with moderate to high confidence to APT29, also tracked as Midnight Blizzard, Cozy Bear and The Dukes. The group is widely attributed to Russia’s Foreign Intelligence Service (SVR).
The operators used three routes to reach their targets. First, they injected JavaScript into legitimate websites, including those of a Ukrainian gas producer, a US trade association for the chemical industry, a far-right European political movement and a Bulgarian military-related site. Second, where they could not break into a site, they built lookalike domains that mirrored the real site and inserted their own script into each page. Third, between 27 August and 3 September they tampered with a tracking script from Plerdy, a Ukrainian web analytics service. Sekoia says thousands of websites load that script, most of them Ukrainian, including military and defence equipment sites.
The UK angle comes from one of the lookalikes. The domain theowo[.]club, now offline, sat between visitors and the real website of Raffles London at The OWO, the hotel in the former Old War Office building on Whitehall. Sekoia points out that the hotel is a short walk from the Ministry of Defence and Downing Street. It suggests the fake site was meant to catch diplomatic delegations and high-profile guests, and cites open-source reports that President Zelensky stayed there on 14 October. The second lookalike copied America250, the US initiative marking 250 years of independence.
The technical picture
All three routes led to the same place: a profiling script the operators named “UltimateFingerprinter”. It records 394 attributes about the visitor’s browser and device. The malicious code was wrapped in roughly 2.3MB of unused AngularJS library code. Sekoia suggests the padding may be meant to overflow the context window of large language models used to triage samples, or to make the file look like a familiar library. In practice, a server mainly used the operating system and browser version to choose an exploit chain.
The researchers recovered three chains. One targeted iOS 16.7 and stole browser cookies. A second, against iOS 18.5, was the DarkSword exploit kit. Sekoia believes DarkSword was built by a commercial surveillance vendor. Here it harvested messages, WhatsApp and Telegram databases, Keychain secrets, Wi-Fi keys, location history, health data, photos and iCloud Drive content. The third chain hit Chrome versions 139 to 145 on Android (oddly skipping 143) and dropped a small stealer Sekoia calls “AndroSnitch”. It takes Chrome cookies, saved logins, browsing history and stored Wi-Fi settings. None of the payloads persisted on the device.
Every vulnerability involved had been fixed by the relevant vendors before the campaign began. Sekoia states that a phone running current software is not exposed. The CVEs include CVE-2025-43529, CVE-2026-20700 and CVE-2026-3910.
The attribution rests on several strands. Google’s Threat Analysis Group told Sekoia the framework resembles a 2024 APT29 watering-hole operation against Mongolian government websites, which also focused on cookie theft. A national CERT found traces of a separate 2025 APT29 watering hole on one of the compromised sites. Infrastructure spread across several hosting providers and a Ukraine-heavy victim list also fit the group’s history. Sekoia adds that the exploits appear to have come from a third party rather than being written in-house.
Why it matters for UK organisations
There are two lessons here. The first concerns targeting. Hotels, venues and event websites used by officials, defence suppliers and their advisers are now part of the attack surface for a state actor. The OWO lookalike shows APT29 thinking about where interesting people go, not just where they work. It echoes the Midnight Blizzard-linked Chatham House lookalike exposed by ReversingLabs, which we covered previously.
The second lesson concerns supply chains. Plerdy is a modest marketing tool, not critical infrastructure. Yet one week of tampering exposed visitors to every site that loaded it. Many UK organisations load third-party analytics, chat and advertising scripts with no integrity checks. DarkSword is not confined to state use either. In October we reported an upgraded version, served through a dead analytics tag, in activity Report URI judged to be financially motivated.
The payloads go after cookies and saved credentials, and that should worry identity teams. A stolen session cookie for webmail or a cloud console can get past multi-factor authentication altogether.
Expert view
When we test mobile estates, patching is nearly always the weakest control. Phones, especially personally owned ones used for email and Teams, are left to update whenever the user gets round to it. This campaign needed no zero-day budget and no user interaction beyond loading a web page. A senior official on an iPhone still running iOS 18.5 was as exposed as anyone.
The AngularJS padding is worth noting. Analysts increasingly rely on AI tools to make sense of suspicious scripts, and attackers are clearly adjusting to that. In my experience, the defences that hold up are boring ones: enforced minimum OS versions, short session lifetimes and knowing exactly what code your website loads from other people’s servers.
I would also caution against treating this as a Ukraine-only problem. The Plerdy compromise was concentrated there, but the lookalike domains point squarely at London and Washington. Sekoia cannot yet say whether the wider net was selective or opportunistic.
What to do now
- Enforce mobile patch levels. Use MDM or conditional access to block corporate email and cloud apps on iOS and Android devices below a current minimum version. This is the Security Update Management control in Cyber Essentials, and it applies to BYOD phones that access organisational data.
- Turn on Lockdown Mode for high-risk staff. Executives, policy teams and anyone travelling to or hosting diplomatic events should use Apple’s Lockdown Mode or Android’s Advanced Protection where available.
- Shorten and bind sessions. Cut session lifetimes for webmail and admin portals, enable token protection or device binding where your identity provider supports it, and watch for the same session being used from a new device or location.
- Audit third-party scripts. Inventory every external script on your public sites, remove the ones you no longer need, and use Subresource Integrity and a Content Security Policy for the rest. This supports Cyber Essentials Secure Configuration.
- Brief travelling and hosting staff. Warn them to be wary of unexpected invitation emails and venue links, and to update their phones before travelling.
- Hunt in proxy and DNS logs. Ask your threat intelligence provider for the Sekoia indicators, and look for mobile devices that visited affected sites or the Plerdy tracker between 27 August and 3 September.
Bottom line
Poisoned Source shows a state actor reaching phones with off-the-shelf, already-patched exploits delivered through ordinary web pages, a marketing script and a convincing copy of a Whitehall hotel. It relied on unpatched phones and trusted third-party code, both of which UK organisations can fix cheaply.
Sources
- Sekoia: Poisoned Source: APT29 watering holes target mobile devices with n-day exploits
- The Hacker News: APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
- Infosecurity Magazine: APT29 Watering Holes Target Unpatched iPhones and Android Devices
- GBHackers: Russian Hackers Create Fake US and UK Websites to Target Visitors With Mobile Exploits
